JP2005534049A - System, method and computer product for delivery and reception of S / MIME encrypted data - Google Patents

Abstract

The system, computer product, and method of the present invention allows users to access their email account on the email server and send S / MIME messages through any browser without having to install client-based email software. Allows creation or reading. From a software delivery and user support perspective, this generally eliminates the need to support client-based email, thus reducing the cost of user and software support, and in addition to supporting user mobility. Respond to the nature. Another aspect of the present invention allows users to remotely access private keys and digital certificates over the Internet from any network connected device. This generally eliminates the need for location-specific storage of private keys and digital certificates.

Description

  The present invention generally relates to secure delivery and reception of data in public key cryptography (PKI). The present invention relates in particular to secure delivery and reception of S / MIME encrypted data (such as electronic mail) using web and WAP browsers connected to the Internet.

  In the past decade, email (e-mail) has generally become a very valuable tool that allows parties to communicate work results quickly, easily and efficiently, Unprecedented use. While e-mail is very useful, the security of data transmitted using e-mail has increased as corporate communications have moved from paper to digital and hackers have become more proficient at entering the e-mail system. In general, concerns have increased. Since 60% of a company's intellectual property can be found in digital form somewhere within its email message system (according to a report statement), the demand for secure email messaging is This is especially true for highly confidential business information.

  In response to this e-mail security requirement, the S / MIME (Standard Specification for E-mail Encryption and Authentication) protocol was established in 1995, mostly by RSA Data Security and other software vendors. The goal of S / MIME was to provide message integrity, authentication, non-repudiation, and confidentiality of email messages through the use of PKI (Public Key Infrastructure) encryption and digital signature technology. Email applications that support S / MIME are guaranteed that network administrators and third parties such as ISPs cannot intercept, read or modify those messages. S / MIME works primarily by building security on top of the normal MIME protocol, which is a method for organizing electronic messages, as well as a method that supports electronic messages in most email applications. Determine.

Currently, the most common version of S / MIME is V3 (version 3), which was introduced in July 1999. For more information on S / MIME standardization and related documents, see the Internet Mail Consortium website (www.imc.org) and the IETF S / MIME Working Group website (www.ietf.org/html.charters/ smime-charter.html).
The S / MIME V3 standard generally consists of the following protocols:
● Encrypted message syntax (RFC2630)
S / MIME version 3 message specification (RFC2633)
S / MIME version 3 authentication process (RFC2632)
Diffie-Hellman key matching method (RFC2631)

  Advanced Security Service (RFC2634) is another protocol for S / MIME, which is a set of extensions that allow signed reception, security labels, and secure mailing lists. Signed reception and security label extensions work with either S / MIME V2 or S / MIME V3, while secure mailing list extensions only work with S / MIME V3 . S / MIME messages are exchanged between users by requiring e-mail software to create S / MIME files according to the S / MIME specification. S / MIME files are sent as email message attachments. When this message reaches the recipient, it can only process it if the recipient has a comparable version of the S / MIME email reader.

  There are a number of issues in exchanging email messages using the current S / MIME standard, including: If the recipient does not have the S / MIME software function, the S / MIME message cannot be accessed, and the S / MIME message is stored without being opened on the recipient's computer. Even if either the sender or the receiver is not registered with the certificate authority, the S / MIME encrypted message cannot be read in the same manner. The same result will occur if there is an incompatibility between the S / MIME version used by the sender and the S / MIME version used by the receiver. In the unlikely event that a security hole is detected, the S / MIME standard intends a general degree of update from the current S / MIME version to the modified S / MIME version, This is a particularly important issue. S / MIME email exchange will also be prevented if there is incompatibility between the email software used by each sender or recipient. S / MIME-encrypted email exchange will also be effectively hampered if the S / MIME-compliant email software is broken or the sender or recipient key expires.

  To remedy many of these problems, recipients typically update or obtain their S / MIME e-mail reader and take advantage of the latest standardized version of the S / MIME protocol. The problem with this solution is the fact that in addition to eating system resources, the user needs to download a fairly large additional software package that requires constant updates.

  The introduction of S / MIME encryption for secure email messaging using a browser is one possible solution to the above problem. A number of prior art solutions using web or WAP browser technology are known.

  For example, the patent application WO00 / 42748 ("Tumbleweed" reference) published on July 20, 2000 by Dmitry Dolinsky and Jean-Christophe Bandini of Tumbleweed Communications, Inc. Disclosed previous solutions for secure web-based email, showing the need to download S / MIME software packages through the use of an intervening host server separate from email software applications . In this solution, the intervening host server stops the email sent by the sender and then sends a message to the recipient's email account notifying them that secure email is waiting. This message also includes a link to the decrypted message located on the intervening host server. The decrypted message is presented to the recipient in an SSL session.

  This prior art solution has a number of disadvantages. In relative terms, the use of an intervening host server generally complicates the entire secure transaction and increases the cost of an infrastructure that provides secure email messaging. Another disadvantage of Tumbleweed technology is that because the sender's computer does not have encryption capabilities, the entire solution carries the associated risks associated with a fairly intrusive network environment. Also, the nature of the solution proposed throughout the Tumbleerrd reference is not easily prepared for deployment across wired and wireless networks.

  Therefore, what is needed is a web-based system for transmitting data (including e-mail) on a secure basis using S / MIME, which is easy to deploy using web and WAP browsers , Computer products and methods. What is further needed is the above mentioned, which is introduced at a relatively low cost in that it is easily introduced and the encryption resources required for S / MIME encrypted messaging are provided at the network connected device itself. Systems, computer products, and methods. What is also needed is a web-based system, computer product, and method that maintains S / MIME encryption throughout the communication of data.

(Summary of the Invention)
The system, computer product, and method of the present invention allows users to access their email account on the email server and send S / MIME messages through any browser without having to install client-based email software. Allows creation or reading. From a software delivery and user support perspective, this generally eliminates the need to support client-based email, thus reducing the cost of user and software support, and in addition to supporting user mobility. Respond to the nature.

  Another aspect of the present invention allows users to remotely access private keys and digital certificates over the Internet from any network connected device. This generally eliminates the need for location-specific storage of private keys and digital certificates.

  A detailed description of a more preferred embodiment is provided below by way of example only with reference to the following drawings.

  In the drawings, a more preferred embodiment of the invention is shown by way of example. It should be clearly understood that the description and drawings are for illustrative purposes only and are to aid in understanding and are not intended to interpret the limitations of the invention.

(Detailed description of more preferred embodiments)
As shown in FIG. 1, at least one known network connection device 10 is provided. Network connection device 10 may include a number of digital devices that provide connectivity to a computer network. For example, the network connection device 10 can include a known personal computer, or a known WAP device, a cell phone, a PDA, and the like.

  The network connection device 10 is connected to the Internet 12 by a known method. With particular reference to FIG. 1, a network connection device 10, which is a known WAP device, is shown connected to the Internet, which also provides a known WAP-to-WEB gateway 107 in a known manner. The

  Each of the network connection devices 10 also includes a browser 20. The browser can be a standard Internet-based browser such as Netscape Navigator or Microsoft Internet Explorer or a known mini-browser of wireless products such as cell phones or PDAs.

  Each of the network connection devices 10 also includes an application 22 of the present invention. Details of this application and how it enables PKI-enabled communication over wired and wireless networks is disclosed in pending application US patent application Ser. No. 10 / 178,224 (“pending application”). The

  In one particular embodiment of application 22, a browser extension or plug-in is provided in a known manner. In particular, application 22 and browser 20 interact, for example, with customized HTML tags. Application 22 works with any third party PKI system, including ENTRUST, MICROSOFT, BALTIMORE, RSA, etc., as described in detail below, while using an intervening host server or fairly large computer program It is desirable to provide the necessary resources. It should also be understood that the functionality of the application 22 described herein can also be provided as an “ACTIVE X object” in a known manner, or incorporated within a browser.

  Each of the network connection devices 10 also includes a browser 20. The browser can be a standard Internet-based browser such as Netscape Navigator or Microsoft Internet Explorer or a known mini-browser of wireless products such as cell phones or PDAs.

  Each of the network connection devices 10 also includes an application 22 of the present invention. In one particular embodiment of the present invention, application 22 is best understood as a browser extension or plug-in provided in a known manner. In particular, application 22 and browser 20 interact, for example, with customized HTML tags.

  However, it should also be understood that for stand-alone applications, the resources of application 22 could also be provided by integration of the functions of application 22 within a browser or mini-browser.

  It is desirable for the application 22 to provide the resources necessary to function in any third party PKI system including, for example, ENTRUST, MICROSOFT, BALTIMORE, RSA, etc., as detailed below.

The application 22 includes an encryption utility 24 provided in a known manner, which is adapted to perform a series of encryption operations on the network-connected device 10, including but not limited to: is not.
-Digital signature of data in form field-Encryption of data in form field-Decryption of data in form field-Verification of data signature in form field-Digital signature and encryption of data in form field- Confirmation of digital signature and decryption of data in form field ・ Digital signature of all pages ・ Verification of digital signature of all pages ・ Encryption of all pages, and
・ Encryption and signature of file attachments

  In particular, the application 22 includes a cryptographic library 300 provided in a known manner. In one specific embodiment of the present invention, the application 22 also encrypts data necessary to encrypt and / or digitally sign data contained in data documents (including emails) contemplated by the present invention. A user certificate and private key storage mechanism 302 containing For example, in one particular implementation of the invention, where Entrust acts as a certificate authority, the .EPF file required to authenticate both the sender and the recipient is downloaded to the network connection device 10. The .EPF file is an encrypted file that is used to access the user certificate and private key necessary to handle the encryption operation.

  The application 22 of the present invention also includes a PKI browser extension, in particular an S / MIME browser extension 304. The S / MIME browser extension allows encryption and decryption of data documents (including e-mails) in the browser, as detailed herein. Since browser technology is commonplace, this has the advantage of a broad base deployment. As shown in FIG. 1, the application 22 of the present invention, including S / MIME browser extensions, can also be associated with a web browser or WAP browser, so it also has the advantage of being deployed across wireless and wired networks. . Furthermore, in the invention disclosed here, which requires only a browser and related application 22 in each network connection device 10, to execute a full S / MIME encryption program / e-mail reader on the network connection device 10. S / MIME-encrypted communication is possible without using resources that are normally required.

  The S / MIME browser extension function 304 is provided in a manner known to skilled programmers. However, it is desirable for the S / MIME browser extension function 304 of the present invention to have a number of characteristics. First, as a result of the method of the present invention described below, the S / MIME browser extension 304 attaches an attachment to an email message and the entire email message becomes an S / MIME message. It would be desirable to be able to sign and encrypt both email messages and attachments. Second, the encryption / decryption of data according to the S / MIME standard described here involves a potential security risk if the S / MIME browser extension 304 is not designed correctly. In particular, it is essential to ensure that browser memory is used in the course of encryption operations so that security is not compromised. In one particular embodiment of the present invention, this is accomplished by using the “TEMP” memory space of browser 20 in a manner known to skilled programmers. Third, the S / MIME browser extension 304 may further include a message that is part of the user certificate and private key storage mechanism 302 from the memory associated with the browser, or a user certificate to maintain confidentiality. Or a clean-up routine in a known manner that removes any remnants of either the private key or otherwise, using the network connection device 10.

  In addition, the S / MIME browser extension 304 helps authorize digital certificates issued by entities unrelated to the application vendor of the present invention, and this is also “mutually authenticated” in a known manner. It is intended that the present invention not. In particular, the S / MIME browser extension 304 is adapted to allow users of the application 22 of the present invention to store digital certificates and public keys of people who are unrelated to the vendor of this application 22. The

  In addition, a web server 106 provided using known hardware and software utilities is connected to the Internet 12 so as to enable the provision of the network connection device 10 in a known manner. The web server 106 includes a web application 16. The web application 16 is configured to execute operations including a PKI operation referred to below.

Two aspects of the present invention are:
1. Create an S / MIME compliant email message and deliver it to an email server
2. Includes systems, computer products, and methods for retrieving and decrypting S / MIME compliant email messages from email servers.

  In order to accomplish the foregoing, the system, computer product, and method of the present invention rely on aspects of a pending application for doing PKI-enabled transactions. In particular, email messages are created and distributed in accordance with the present invention in a manner similar to “secure-based data posting” described in pending applications. Email messages are retrieved and decrypted in a manner similar to “Secure Base Data Retrieval” which is also described in the pending patent application. For details on how the application 22 of the present invention processes encryption operations, refer to the pending patent application.

  As shown in FIG. 1, one aspect of the system of the present invention also includes a known email server 306. The email server 306 sends and receives emails using well-known techniques. The email server 306 is provided by known hardware and software utilities. As also shown in FIG. 1, one aspect of the system of the present invention includes an email protocol conversion mechanism 308. The email protocol conversion mechanism 308 allows the web server 106 and email server 306 to convert messages sent by the web server 106 to a specific email protocol understood by the email server 306, such as POP3 or IMAP4. A known utility that allows communication by translating.

Creating an S / MIME-compliant email message and delivering it to an email server FIG. 3 illustrates the creation of an S / MIME-compliant email message and delivery to the email server according to the present invention.

  A user associated with a network-connected device 10 (“Sender”) who wishes to create and send an email on a secure basis can use a browser 20 loaded on the network-connected device 10 on a web server 106. Request a page.

  The web server 106, in particular, cooperates with the web application 16 loaded on the web server 106 to gain access to the web application 16, especially the web email application (not shown) contained within the web application 16. In order to do so, the network connection device 10 is answered by displaying a web page, which is a web form that requires a user associated with the network device 10 to provide authentication.

  The sender provides the information in the authentication form fields (such as username and password) on the web page and typically submits the form by pressing the “Submit” button or equivalent That ’s it.

  An authentication certificate is sent to the web server 106. Next, the web server 106 distributes the authentication certificate to the email server 306 via the email protocol conversion mechanism 308.

  In particular, according to aspects of the present invention that use the roaming key server 310 to access the user certificate and private key storage mechanism 302, the web server 106 also forwards the user certificate to the roaming key server 310.

  The email server 306 authenticates the sender, and then displays the message waiting list and other relevant information about the sender's email account for display in the sender's browser 20, email protocol It is sent back to the web server 106 through the conversion mechanism 308 and an email session is established in a known manner, typically using cookies.

  Again, according to aspects of the present invention that utilize the roaming key server 310, the roaming key server 310 authenticates the sender and transmits the sender's private key and certificate to the S / MIME browser extension 304 through the web server 106. . According to an aspect of the present invention in which the user certificate and private key storage mechanism is in the network connection device 10, the S / MIME browser extension 304 accesses the private key and certificate.

  The sender prepares the email message by completing the appropriate fields of the referenced web form, including, for example, the message title, body, and intended recipient fields. In one particular embodiment of the invention, application 22 also provides a recipient password.

  Communicate with the certificate authority 312, thereby verifying the recipient's public key and certificate and retrieving them from the associated directory 314.

  Message form data to sign and encrypt the message and any attachments using the sender's private key and the recipient's public key, and to form S / MIME compliant email messages Is sent to the application 22 including the S / MIME browser extension 304.

  The message is returned to the browser 20, sent from the browser 20 to the web server 106, and sent to the email server 306 using the email protocol conversion mechanism 308 for forwarding to the identified recipient.

Retrieving and decrypting S / MIME compliant email messages from an email server FIG. 2 illustrates the reception, confirmation, decryption, and display of S / MIME compliant messages from an email server according to the present invention.

  A user associated with a network-connected device 10 (“Recipient”) who wishes to display a secure S / MIME-compliant message received on a secure basis uses a browser 20 loaded on the network-connected device 10 , Request a page on the web server 106.

  The web server 106 specifically cooperates with the web application 16 loaded on the web server 106 to the web application 16, particularly the web email application (not shown) contained within the web application 16. In order to gain access, the network connected device 10 is answered by displaying a web page, which is a web form that requires the recipient to provide authentication.

  The recipient provides the information in the authentication form fields (such as username and password) on the web page and typically submits the form by pressing the “Submit” button or equivalent That ’s it.

  An authentication certificate is sent to the web server 106. Next, the web server 106 distributes the authentication certificate to the email server 306 via the email protocol conversion mechanism 308.

  In particular, according to aspects of the present invention that use the roaming key server 310 to access the user certificate and private key storage mechanism 302, the web server 106 also forwards the user certificate to the roaming key server 310.

  The email server 306 authenticates the recipient, and then through the email protocol conversion mechanism 308 for the message waiting list and the recipient's email account for display in the recipient's browser 20. Send other relevant information back to the web server 106 and establish an email session in a known manner, typically using cookies.

  The email server authenticates the recipient, and then through the email protocol conversion mechanism 308 for other indications about the message waiting list and the recipient's email account for display in the recipient's browser 20. The relevant information is sent back to the web server 106, typically using cookies to establish an email session.

  Again, according to aspects of the present invention that utilize the roaming key server 310, the roaming key server 310 authenticates the recipient and transmits the recipient's private key and certificate to the S / MIME browser extension 304 through the web server 106. . According to aspects of the present invention in which the user certificate and private key storage mechanism is in the network connection device 10, the S / MIME browser extension 304 accesses the private key and certificate.

  Along with the message request, the recipient requests a message to read which request was sent to the web server 106 and sent to the email server 306 through the email protocol conversion mechanism 308.

  The email server 306 retrieves the message and transmits the message to the recipient through the web server 106 to the recipient's browser 20 using the email protocol conversion mechanism 308.

  The application 22 authenticates against its user certificate and private key storage 302, thereby decrypting the message for display on the recipient's browser 20 when the key can be verified. Release to that S / MIME browser extension 304 component. Instead, an aspect of the present invention that utilizes a roaming key server 310 authenticates against data provided by the roaming key server 310 that can verify the message signature and decrypt the message with the S / MIME browser extension 304. Occurs.

  As another aspect of the present invention, the persistent field level encryption disclosed in the pending application, for the purposes of the present invention, the associated data is encrypted and the database associated with the web server 106 ( By storing the data in encrypted form (not shown), the identity of the user's identity (e.g., the client with which the user communicates in a secure basis) and other personal information is kept confidential Used to do.

  The system of the present invention is best understood as the entire system including the network connection device 10 and its resources, including the application 22, the web server 106, the email server 306, and these resources as well. The computer product of the present invention is an application 22 on the one hand and a web application 16 on the other hand. Another aspect of the invention includes a remote key server 310.

  The method of the present invention is best understood as a process for exchanging PKI S / MIME messages through either a web browser or a WAP browser. Also, the method of the present invention should be understood as a method of integrating Internet secure messaging and wireless devices using S / MIME. Another aspect of the method of the present invention is a method for distributing private keys and certificates over the Internet or a wireless network. Yet another aspect of the present invention is a method of removing a “middle man” security hole in a proxy-based gateway between the Internet and a wireless network by providing persistent secure data communication using S / MIME. is there. Yet another aspect of the invention is a method for allocating data resources to provide a PKI to a wireless device so as to provide S / MIME encryption on a persistent basis between the web server and the wireless device. .

  The present invention also provides for permanent field level encryption using S / MIME on a selective basis throughout Internet-based data processing. This facilitates efficient use of resources by invoking PKI operations on specific elements of Internet-based data processing that most require security / authentication.

  The present invention also provides a set of tools that add PKI S / MIME functionality to the browser in an efficient manner.

  The present invention should also be understood as a set of tools for meeting legitimate digital signature requirements, including relating to wireless devices using web mail systems that incorporate S / MIME.

  Yet another aspect of the present invention is a method that enables secure email messaging between a wireless network and an Internet-based network or other network using S / MIME.

1 is a schematic diagram of system architecture components of an S / MIME browser-based email system. FIG. It is a chart of the program resource which shows the resource of the application of this invention. 6 is a flowchart showing steps for receiving, confirming, and decrypting an S / MIME message from an email server for display within a browser. 6 is a flowchart showing steps for creating, signing, and encrypting an S / MIME message in a browser for transmission to a web server going to an email server. FIG. 4 is a schematic diagram of the detailed steps involved in creating, signing, and encrypting an unencrypted message. FIG. 5 is a schematic diagram of the detailed steps associated with retrieving and decrypting an encrypted message.

Claims (12)

(a) at least one network connection device for communicating with one or more remote devices via a communication network;
The network connection device comprises:
(b) a browser linked to the network connection device;
(c) an encryption / decryption function linked to the browser to allow PKI transactions to be performed within the browser; and
(d) in cooperation with the encryption / decryption function, allowing the network connection device to exchange S / MIME compliant documents with a remote network connection device via the browser; and S / MIME function linked to the encryption / decryption function,
A system for electronically exchanging S / MIME compliant documents, characterized by The system also
(e) a key storage means for storing a plurality of keys, each of which can be used by an associated user in a public key infrastructure to encrypt and decrypt data; and
(f) User authentication means for determining whether a unique user of a key among the plurality of keys is the related user of the key;
When the user authentication means authenticates a user of the network connection device, the encryption / decryption function encrypts and decrypts data using the plurality of keys. / Decryption function is linked to the key storage means and the user authentication means,
A system for electronically exchanging S / MIME documents according to claim 1. The system further includes an email server, and the encryption / decryption function and the S / MIME function exchange S / MIME-compliant messages between the network connection device and the email server. Enable,
The system according to claim 2. The user authenticator communicates with a certificate authority to authenticate the unique user;
The system according to claim 3. The user authentication means includes a roaming key server that authenticates a sender of an S / MIME-compliant document and transmits the sender's private key and certificate to the network connection device via the remote server.
The system according to claim 4. (a) browser,
(b) an encryption / decryption function linked to the browser so as to allow PKI transactions to be performed within the browser; and
(c) enabling the network connection device to exchange an S / MIME compliant document with a remote device via the browser in cooperation with the encryption / decryption function, and the browser and the encryption / decryption S / MIME function linked to decryption function,
A computer product operable on the network connection device to enable S / MIME compliant communication between the network connection device and the remote device over a communication network. (a) a key storage means for storing a plurality of keys, each of which can be used by an associated user in a public key infrastructure to encrypt and decrypt data; and
(b) user authentication means for determining whether a unique user of a key of the plurality of keys is the related user of the key;
And the encryption / decryption function encrypts and decrypts the data using the plurality of keys when the user authentication means authenticates the user of the network connection device. 7. The computer product according to claim 6, wherein an encryption / decryption function is linked to the key storage means and the user authentication means. The S / MIME function is an S / MIME browser extension function;
8. A computer product according to claim 7. The S / MIME function enables encryption and signing of electronic messages and attachments;
9. A computer product according to claim 8. Providing the S / MIME function so that encryption operation security in the computer product is maintained;
10. A computer product according to claim 9. (a) provide encryption / decryption functions and S / MIME functions that are linked to the browser and loaded on the network-connected device associated with the sender;
(b) authenticating the sender at a remote server by user authentication means linked to the network connection device;
(c) The sender requests S / MIME-compliant communication with the receiver from the remote server,
(d) The remote server transmits the recipient's private key and certificate to the S / MIME function,
(e) the network connection device communicates with a certificate authority by the encryption / decryption function to verify the recipient's public key and certificate; and
(f) Signing and encrypting the document in the browser using the sender's private key and the recipient's public key, thereby encrypting / decrypting functions and S / MIME A method for electronically transmitting an S / MIME compliant document, comprising the step of creating an S / MIME compliant document by function. (a) Provide encryption / decryption functions and S / MIME functions that are linked to the browser and loaded on the network connection device.
(b) request a search for an S / MIME-compliant document from the network-connected device,
(c) authenticate the recipient associated with the network connection device with a remote server;
(d) The remote server transmits the sender's private key and certificate to the S / MIME function,
(e) the remote server sends the requested S / MIME compliant document to the network connection device;
(f) The encryption / decryption function compares the recipient's private key and certificate with the private key and certificate stored in the key / certificate storage mechanism accessible from the network connection device. Authenticating and releasing the private key and certificate to the S / MIME function during the authentication, thereby enabling the S / MIME compliant document to be decrypted in the browser.
A method for electronically retrieving and decrypting an S / MIME-compliant document, comprising: steps.

Images